feat(data): native Binance REST kline fetcher in 9 languages (#315)

Adds `BinanceRest::fetch_klines` to `wickra-data`: a blocking historical kline
downloader (`GET /api/v3/klines`) and the historical counterpart to the F4 live
`BinanceFeed`. It is the last native data-layer primitive needed to drop
third-party HTTP/JSON download helpers (`jackson`, `jsonlite`, `urllib`, …) from
the examples.

## What

- **Core** (`wickra-data`): `fetch_klines(symbol, interval, limit, start?, end?)`
  built on `ureq` with native-tls — sharing the exact same TLS backend
  (native-tls 0.2 / SChannel) as the existing tokio-tungstenite live feed, so the
  two pull one TLS stack, not two. Parses Binance's 12-element array rows via the
  existing serde infrastructure into validated `Candle`s. Blocking by design (a
  one-shot request needs no async runtime; the FFI boundary is synchronous
  anyway). Nine mock-HTTP-server tests cover parse / empty / limit / transport /
  JSON / invariant-violation paths.
- **C ABI**: `wickra_binance_fetch_klines(...)` (blocking drain into a caller
  buffer, `-1` on error) + regenerated cbindgen header and its vendored Go copy.
- **Bindings**: native Node `fetchBinanceKlines` / Python `fetch_binance_klines`;
  generated Go `FetchBinanceKlines` / C# `BinanceFeed.FetchKlines` / Java
  `BinanceFeed.fetchKlines` / R `fetch_binance_klines`. C / C++ call the C ABI
  directly. **WASM is excluded** (browsers use the host `fetch`).

The four C-ABI bindings are regenerated from the ScriptHelpers generators (not
hand-edited); the regen diff is exactly the new wrapper in each.

## Verification

All ten toolchains green locally: Rust (`cargo test`/`clippy`/`fmt`), Node, Python,
Go, C#, Java, R (`R CMD INSTALL` + smoke), WASM (`cargo check`, confirmed `ureq`
is not pulled). Each binding has an error-path smoke test; the parse/HTTP success
path is covered by the Rust mock-server tests.

No release in this PR — ships with the data-layer + numpy bundle later.

bindings/node/__tests__/binance.test.js

@@ -4,7 +4,7 @@
 
 const test = require('node:test');
 const assert = require('node:assert/strict');
-const { BinanceFeed } = require('..');
+const { BinanceFeed, fetchBinanceKlines } = require('..');
 
 test('binance feed rejects an unknown interval', () => {
   assert.throws(() => new BinanceFeed('BTCUSDT', 99));
@@ -17,3 +17,18 @@ test('binance feed rejects an empty symbol list', () => {
 test('binance feed rejects an unreachable endpoint', () => {
   assert.throws(() => new BinanceFeed('BTCUSDT', 1, 'ws://127.0.0.1:1'));
 });
+
+// The REST fetcher's parse/HTTP success path is covered deterministically by the
+// Rust mock-HTTP-server tests in wickra-data; here we only assert the binding's
+// error paths, which short-circuit before (or fail fast at) the network.
+test('fetchBinanceKlines rejects an unknown interval', () => {
+  assert.throws(() => fetchBinanceKlines('BTCUSDT', 99, 1));
+});
+
+test('fetchBinanceKlines rejects an out-of-range limit', () => {
+  assert.throws(() => fetchBinanceKlines('BTCUSDT', 6, 0));
+});
+
+test('fetchBinanceKlines surfaces an unreachable endpoint', () => {
+  assert.throws(() => fetchBinanceKlines('BTCUSDT', 6, 1, null, null, 'http://127.0.0.1:1'));
+});